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DETAILED ACTION 



Priority 

1 . The instant application claims benefit of the filing date and priority (continuation) to the U.S. 
Non-Provisional Patent Application S/N 09/608,806, filed on 30-June-2000, which claims 
the benefit of U.S. Provisional Patent Application S/N 60/141,755, filed on 30-June-1999. 
Accordingly, the filing date of the Provisional Patent Application (30-June-1999) is 
considered the effective filing date for the examination of the instant application. 



Drawings 

2. The drawings are objected to as failing to comply with 37 CFR 1.84(p)(5) because they 
include at least one reference character not mentioned in the description. For example: 
Reference character 38" in figure 9. 
The above is one example of reference characters not mentioned in the descriptions. The 
applicant is requested to review and correct all sheets of drawings as appropriate. 



3. Corrected drawing sheets in compliance with 37 CFR 1 .121(d) are required in reply to the 
Office action to avoid abandonment of the application. Any amended replacement drawing 
sheet should include all of the figures appearing on the immediate prior version of the sheet, 
even if only one figure is being amended. The figure or figure number of an amended 
drawing should not be labeled as "amended." If a drawing figure is to be canceled, the 
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appropriate figure must be removed from the replacement sheet, and where necessary, the 
remaining figures must be renumbered and appropriate changes made to the brief description 
of the several views of the drawings for consistency. Additional replacement sheets may be 
necessary to show the renumbering of the remaining figures. Each drawing sheet submitted 
after the filing date of an application must be labeled in the top margin as either 
"Replacement Sheet" or "New Sheet" pursuant to 37 CFR 1.121(d). If the changes are not 
accepted by the examiner, the applicant will be notified and informed of any required 
corrective action in the next Office action. The objection to the drawings will not be held in 
abeyance. 

Specifications 

4. The specification of the instant application is objected to in view of the objections made 
above to the drawings. The specification must correctly and sufficiently reference every 
element shown on the drawing figures. Wherever there is a discrepancy between an element 
depicted in the drawings and references made to the element in the specification (or lack 
thereof), either the figures of drawings, or the specifications, or both must be corrected to 
overcome the discrepancy. Appropriate corrections to the specifications are required. 

Double Patenting 

5. The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent 
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possible harassment by multiple assignees. See In re Goodman, 1 1 F.3d 1046, 29 
USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); 
In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 
164 USPQ 619 (CCPA 1970); and, In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 
1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) may be used to 
overcome an actual or provisional rejection based on a nonstatutory double patenting ground 
provided the conflicting application or patent is shown to be commonly owned with this 
application. See 37 CFR 1.130(b). 

Effective January 1, 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 
CFR 3.73(b). 

6. Independent claims 1,17 and 21 of the instant application are rejected under the judicially 
created doctrine of double patenting over claims 1, 10 and 11 (respectively) of Ross et al 
(U.S. Patent No. 6,643,648 Bl) since the claims, if allowed, would improperly extend the 
"right to exclude" already granted in the patent. 



INSTANT APPLICATION 10/674,580 


ROSS et al. US 6,643,648 Bl 


1. A database system regulating access to 
one or more data records according to 
authorized access rights, the database system 
comprising: 


1. A database system regulating access to 
one or more data records according to 
authorized access rights, the database system 
comprising: 
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one or more data crystals storing one or more 
data records in an obfuscated format; 

one or more iterators, each iterator 
programmed to access, deobfuscate, and 
return at least 

one of the one or more data records in 
response to a data request; 

one or more queries, each query predefined to 
receive an indication of an authorized type of 
data requirement, to request at least one data 
record from the iterator, and to select from 
among the returned at least one data record a 
requested data record satisfying the data 
requirement; and 

a key crystal granting access rights for the 
database system. 


one or more data crystals storing one or more 
data records in an obfuscated format; 

one or more iterators, each iterator 
programmed to access, deobfuscate, and 
return at least one of the one or more data 
records in response to a data request; 

one or more queries, each query predefined to 
receive an indication of an authorized type of 
data requirement, to request at least one data 
record 

from the iterator, and to select from among the 
returned at least one data record a requested 
data record satisfying the data requirement; 
and 

a key crystal granting access rights for the 
database system; 

wherein: the access rights include crystal 
oermi^sions" 

the crystal permissions divide the one or more 
data crystals into active data crystals and inactive 
data crystals; and 

the inactive crystals are inaccessible during 
operation of the database system. 


17. A controlled access database system 
comprising: 

a plurality of data crystals, each data crystal 
containing at least one data record employing 
an obfuscation technique; 

an iterator programmed to access the at least 
one data record according to the obfuscation 
technique; 

at least one query of a predefined type: 
wherein one or more of the at least one query 
is called by an application with a data 
requirement; 

wherein the data requirement of the 
application determines the one or more called 
query; and 


10. A controlled access database system 
comprising: 

a plurality of data crystals, each data crystal 
containing at least one data record employing 
an obfuscation technique; 

an iterator programmed to access the at least 
one data record according to the obfuscation 
technique; 

at least one query of a predefined type: 
wherein one or more of the at least one query 
is called by an application with a data 
requirement; 

wherein the data requirement of the 
application determines the one or more called 
query; and 
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wherein the one or more called query employs 
the iterator to access the at least one data 
record; and 

a key crystal granting access rights to the 
database system. 


wherein the one or more called query employs 
the iterator to access the at least one data 
record; and 

a key crystal granting access rights to the 
database system; 

wherein the access rights are limited according to 
a criterion selected from a group 
consisting of: 

a customer identifier, a customer site, a customer 
computer system, an expiration date, and a 
number of times accessing the database system. 


21. A method for building a controlled-access 
database for preventing unauthorized access 
to data records, the method comprising the 
steps of: 

obtaining a data record; 

storing the data record in a data crystal in an 
obfuscated format; 

providing an iterator to access and 
deobfuscate the obfuscated data record; 

providing a query to request the iterator to 
locate and access the data record only in 
accordance with a preauthorized type of data 
requirement; and 

providing a key crystal authorizing use of the 
data crystal and the query according to the 
preauthorized type of data requirement. 


11. A method for building a controlled-access 
database for preventing unauthorized access 
to data records, the method comprising the 
steps of: 

obtaining a data record; 

storing the data record in a data crystal in an 
obfuscated format; 

providing an iterator to access and 
deobfuscate the obfuscated data record; 

providing a query to request the iterator to 
locate and access the data record only in 
accordance with a preauthorized type of data 
requirement; 

providing a key crystal authorizing use of the 
data crystal and the query according to the 
preauthorized type of data requirement; 

obtaining a second data record; 

storing the second data record in a second data 
crystal in an obfuscated format; and 

specifying, in the key crystal, access rights 
rendering the first data crystal active and the 
second data crystal inactive. 
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As shown above, claims 1, 10 and 11 of Ross et al (U.S. Patent No. 6,643,648 Bl) 
contains every element of claims 1,17 and 21 of the instant application and as such 
anticipates claims 1,17 and 21 of the instant application. 

"A later application claim is not patentably distinct from an earlier patent claim if the 
later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896, 
225 USPQ at 651 (affirming a holding of obviousness-type double patenting because the 
claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 
1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of obviousness-type double 
patenting where a patent application claim to a genus is anticipated by a patent claim to a 
species within that genus)." ELI LILLY AND COMPANY v BARR LABORATORIES, 
INC., United States Court of Appeals for the Federal Circuit, ON PETITION FOR 
REHEARING EN BANC (DECIDED: May 30, 2001). 



Claim Rejections - 35 USC § 101 
7. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 



8. Independent claims 1,17 and 21 (and their dependent claims) are rejected under 35 
U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. 
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The result produced by independent claims 1 and 17 is stated as, "a key crystal granting 
access rights to the database system"; and the result produced by independent claim 21 is 
stated as, "providing a key crystal authorizing use of the data crystal and the query according 
to the authorized type of data requirement", none of which is considered "tangible". 

"granting access" and "authorizing use" are interpreted by the Examiner to indicate 
"decisions being made". However, the outcome of the decision ("granting access" or 
"authorizing use") is not tangibly communicated or presented to the user, nor is any 
indication of such "granting" or "authorizing" stored anywhere in memory. 

This rejection can be overcome by amending the independent claims to ensure tangible 
results (e.g., by adding the step of: "upon granting the access [or authorizing the use], 
notifying the user"; or "storing an indication of the access grant [or use authorization] in 
memory".) 

Appropriate corrections are required. 



Claim Rejections - 35 USC §102 
9. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 
(e) the invention was described in 

(1) an application for patent, published under section 122(b), by another filed in the United States before the 
invention by the applicant for patent or 

(2) a patent granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 35 1(a) shall 
have the effects for purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 21(2) of such treaty in the 
English language. 
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10. Claims 1-7 and 9-21 are rejected under 35 U.S.C. 102(e) as being anticipated by Eller et al 
(U.S. patent No. 5,889,860, hereinafter referred to as Eller .) 

As to claim 1, Eller teaches a database system (see "database of information on a server" 
in column 2, lines 17-18) regulating access to one or more data records (see column 1, lines 
66-67, where "regulating access" is read on "controlling access to protected information") 
according to authorized access rights (see column 2, lines 48-51, where "access rights" is 
read on "access authorization"), the database system comprising: 

one or more data crystals (see column 5, lines 50-53, where "data crystal" is read on 
"compressing and encrypting" the data; and see "compressed data stream" in column 8, lines 
2-6) storing one or more data records in an obfuscated format (see "storing information in 
memory in its encrypted form" in column 3, lines 18-20; and see column 5, lines 50-53, 
where "obfuscated format" is read on "compresses and encrypts"); 

one or more iterators (see column 4, lines 46-49, where "iterator" is read on "accessing 
program"), each iterator programmed to access, deobfuscate, and return at least one of the 
one or more data records in response to a data request (see column 3, lines 18-26, where 
"access" is read on "retrieving"; and "deobfuscate" is read on "decrypting", and "return one 
or more data records" is read on "outputting the information for use by the client"); and 

one or more queries (see column 2, lines 20-21, where "query" is read on "request by a 
client"), each query predefined to receive an indication of an authorized type of data 
requirement (see column 2, lines 22-25, where "authorized type of data" is read on 
"information for a specific client"), to request at least one data record from the iterator (see 



Application/Control Number: 10/674,580 Page 10 

Art Unit: 2165 

column 3, lines 2-11, where "one data record" is read on "selected portion of the 
information"), and to select from among the returned at least one data record a requested data 
record satisfying the data requirement (see "client can browse through selection prior to 
making a purchase decision" in column 3, lines 11-14); and 

a key crystal (see column 4, lines 32-36, where "key crystal" is read on "assigning 
decryption key") granting access rights for the database system (see column 2, lines 48-51, 
where "granting" is read on "enabling"; and "access rights" is read on "transaction-specific 
access authorization"; and see column 3, lines 2-8.) 

As to claim 2, Eller teaches the system further comprising an application to provide the 
indication of the data requirement (see column 2, lines 22-25, where "data requirements" is 
read on "information for a specific client") to the one or more queries (see column 2, lines 
20-21, where "query" is read on "request by a client"), wherein the application has direct 
access to the one or more queries but not the one or more iterators (see "limited multiple-use 
authorization" in column 2, lines 7-10), the one or more data crystals, or the one or more data 
records (see column 3, lines 11-14.) 

As to claim 3, Eller teaches wherein the application selects among the one or more 
queries based on the type of data requirement (see "browse through a selection of scores" in 
column 3, lines 2-14.) 
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As to claim 4, Eller teaches wherein the obfuscated format is chosen from the group 
consisting of: compression, encryption, XOR operations, and general bit order or bit logical 
manipulation (see column 7, lines 40-53.) 

As to claim 5, Eller teaches wherein the obfuscated format is compression so as to reduce 
memory requirements for the storing of the one or more data records (see column 5, lines 50- 
53, where "obfuscation" is done by "compressing and encrypting", and "reducing memory 
requirements" is read on "storing the encrypted score in the download area"; and see column 
7, lines 40-53, where "compression logic" is taught. It's well established in the art that 
compressing data reduces memory requirements for storing the data.) 

As to claim 6, Eller teaches the system further comprising an iterator interface 
corresponding to a specific iterator and a corresponding data crystal (see column 4, lines 46- 
49, where "iterator" is read on "accessing program"); and 

wherein: 

the iterator interface acts as a buffer between the one or more queries and the 
corresponding iterator (see column 2, lines 14-25, where "queries" is read on "request by a 
client"; and see column 4, lines 32-36, where the "accessing program" serves as a client's 
interface [acts as a buffer] to access desired musical scores [queries]); and 

the iterator interface allows the queries to work with a different version of the specific 
iterator and corresponding data crystal (see column 2, lines 30-37.) 
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As to claim 7, Eller teaches the system further comprising an access key for 
interchangeably enabling or disabling the system (see "displays the first page" and "disables 
printing or MIDI extraction" in column 7, lines 31-39; also, in the same paragraph, "music is 
decrypted and displayed" [system enabled], or "an error message is displayed" [system 
disabled], based on valid/unexpired password [access key]). 

As to claim 9, Eller teaches wherein the access key is a software component (See column 
3, lines 15-33; and see column 4, lines 32-36, where "decryption keys or passwords" are 
assigned, which are both software components.) 

As to claim 10, Eller teaches wherein at least one data record includes a link to an 
external storage location (see column 4, lines 40-58; and see column 5, lines 65-67, where 
"link to an external storage location" is read on "the URL address of the newly encrypted 
music".) 

As to claim 11, Eller teaches wherein at least one of the one or more data records 
includes unobfuscated clear text (see column 2, lines 18-20, where "obfuscated clear text" is 
read on "encrypting at least a portion of the information using a key-based encryption 
system.) 
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As to claim 12, Eller teaches wherein: 

the one or more data records include a first data record and a second data record (see 
column 9, lines 45-47, where "one or more data records" is read on "copies of information 
items"); 

the first data record employs a first obfuscated format and the second data record 
employs a second obfuscated format (see column 6, line 61 through column 7, line 13, where 
"base 72 number string encoding format" and "MIDI" tags are taught); and 

the second obfuscated format is different than the first obfuscated format (see column 7, 
lines 40-67, where different encoding/encrypting methods [e.g. compression logic, random 
number generator, and XOR] are taught.) 

As to claim 13, Eller teaches the system further comprising a viewer (see "viewing 
monitor" in column 4, line 63) to view a select data record without enabling full access to all 
of the one or more data records (see "limited, multiple-use authorization and pre-purchase 
sampling of copyrighted works or other confidential subject matter" in column 2, lines 7-10; 
and see column 7, lines 31-39.) 

As to claim 14, Eller teaches wherein the one or more data crystals, the one or more 
iterators, and the one or more queries are deployed at an unsecured customer location (see 
column 7, lines 28-30; column 8, lines 45-63, where "deployed at an unsecured customer 
location" is read on "transmitted in unencrypted form to be displayed on client monitor".) 
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As to claim 15, Eller teaches each iterator corresponds to only one of the one or more 
data crystals (see "purchase a copy of the music in sheet music form", and "single-use 
license" in column 6, lines 12-25.) 

As to claim 16, Eller as modified, teaches wherein a first query can call a second query 
to employ at least one of the one or more iterators (see "using a search function to call a title" 
in column 5, lines 45-49, where "a first query" is read on "using a search function", and "call 
a second query" is read on "call a title".) 

As to claim 17, Eller teaches a controlled access database system (see column 1, lines 5- 
12; and see column 1, lines 66-67, where "controlling access to protected information" is 
taught) comprising: 

a plurality of data crystals (see column 5, lines 50-53, where "data crystal" is read on 
"compressing and encrypting" the data; and see "compressed data stream" in column 8, lines 
2-6), each data crystal containing at least one data record (see column 3, lines 18-20) 
employing an obfuscation technique (see "storing information in memory in its encrypted 
form" in column 3, lines 18-20; and see column 5, lines 50-53, where "obfuscated technique" 
is read on "compresses and encrypts"); 

an iterator (see column 4, lines 46-49, where "iterator" is read on "accessing program") 
programmed to access the at least one data record according to the obfuscation technique (see 
column 3, lines 18-26, where "access" is read on "retrieving", and "obfuscation technique" is 
read on "decrypting"); 
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at least one query of a predefined type (see column 2, lines 20-21, where "query" is read 
on "request by a client"): 

wherein one or more of the at least one query is called by an application with a data 
requirement (see column 2, lines 22-25, where "authorized type of data" is read on 
"information for a specific client"); 

wherein the data requirement of the application determines the one or more called query 
(see "client can browse through selection prior to making a purchase decision" in column 3, 
lines 11-14; and see column 5, lines 30-35); 

wherein the one or more called query employs the iterator to access the at least one data 
record (see column 3, lines 18-26, where "access" is read on "retrieving"; and see column 5, 
lines 38-42); and 

a key crystal (see column 4, lines 32-36, where "key crystal" is read on "assigning 
decryption key") granting access rights for the database system (see column 2, lines 48-51, 
where "granting" is read on "enabling"; and "access rights" is read on "transaction-specific 
access authorization"; and see column 3, lines 2-8.) 

As to claim 18, Eller teaches wherein the key crystal authorizes access to a specific data 
crystals out of the plurality of data crystals, wherein the specific data crystal is authorized for 
the application (see column 4, lines 30-39, where "specific data crystal" is read on "selected 
scores".) 
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As to claim 19, Eller teaches wherein the key crystal authorizes access to a specific query 
out of the at least one query, wherein the specific query is authorized for the application (see 
"transaction specific access authorization" in column 2, lines 48-51; and see column 3, lines 
2-8.) 

As to claim 20, Eller as modified, teaches wherein a first query can call a second query 
to employ the iterator (see "using a search function to call a title" in column 5, lines 45-49, 
where "a first query" is read on "using a search function", and "call a second query" is read 
on "call a title".) 

As to claim 21, Eller teaches a method for building a controlled-access database (see 
column 1, lines 5-9 see column 1, lines 66-67, where "controlling access to protected 
information" is taught) for preventing unauthorized access to data records (see column 3, 
lines 37-39 and lines 43-52), the method comprising the steps of: 

obtaining a data record (see column 8, lines 40-44); 

storing the data record in a data crystal (see column 5, lines 50-53, where "data crystal" is 
read on "compressing and encrypting" the data; and see "compressed data stream" in column 
8, lines 2-6) in an obfuscated format (see column 2, lines 26-37, where "obfuscated format" 
is read on "encoded versions"; also see column 5, lines 50-53, where "obfuscated format" is 
read on "compresses and encrypts"); 
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providing an iterator (see column 4, lines 46-49, where "iterator" is read on "accessing 
program") to access and deobfuscate the obfuscated data record (see column 3, lines 18-26, 
where "deobfuscate" is read on "decrypting"); and 

providing a query (see column 2, lines 20-21, where "query" is read on "request by a 
client") to request the iterator to locate and access the data record (see column 3, lines 2-11) 
only in accordance with a preauthorized type of data requirement (see column 3, lines 11- 
14); and 

providing a key crystal authorizing use of the data crystal and the query according to the 
preauthorized type of data requirement (see column 7, lines 31-39, where "preauthorized" is 
read on "music is decrypted and displayed if the password is valid or unexpired".) 

Claim Rejections - 35 USC §103 

11. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

12. Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over Eller in view of 
Schneck et al (U.S. patent No. 6,314,409 B2, hereinafter referred to as Schneck.) 

As to claim 8, Eller teaches access key (see column 4, lines 32-36.) 
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Eller does not teach wherein the access key is a hardware dongle. 

Schneck teaches an access control system for the distribution of data (see column 6, lines 
61-64), in which he teaches wherein the access key is a hardware dongle (see column 5, lines 
26-27; and see column 24, line 66 through column 25, line 6.) 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Eller by the teaching of Schneck , because 
including a dongle as an access key would further protect copyrighted data by preventing 
unauthorized access to the machine/storage device containing the data. Data secured by 
hardware offers added protection to data as it "eliminates the potential for modifying and 
subverting the identification software", as taught by Schneck , column 25, lines 4-6.) 

Conclusion 

13. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

The following patents are cited to further show the state of art with respect to methods 
and systems of controlled-access database systems and rights protections in general: 



Patent/Pub. No. 


Issued to 


Cited for teaching 


US 6,760,843 Bl 


Carter 


Use of hard "dongles" as access keys. 


US 2005/0204348 Al 


Horning et al. 


Protecting program from unauthorized use by 
compression and obfiiscation of data. 



Application/Control Number: 10/674,580 



Page 19 



Art Unit: 2165 

14. Any inquiries concerning this communication or earlier communications from the examiner 
should be directed to Tony Mahmoudi whose telephone number is (571) 272-4078. The 
examiner can normally be reached on Mondays-Fridays from 08:00 am to 04:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Jeffrey Gaffin, can be reached at (571) 272-4146. 




Tony Mahmoudi 

Patent Examiner 
Art Unit 2165 
Tel. (571)272-4078 
Fax (571)273-4078 



tony.mahmoudi(5)uspto.qov 



